* [ANNOUNCE] Release v4.19.325-cip137
@ 2026-11-13 16:33 Ulrich Hecht
0 siblings, 0 replies; only message in thread
From: Ulrich Hecht @ 2026-11-13 16:33 UTC (permalink / raw)
To: cip-dev@lists.cip-project.org, pavel@nabladev.com,
jan.kiszka@siemens.com, masami.ichikawa@cybertrust.co.jp,
chris.paterson2@renesas.com, nobuhiro.iwamatsu.x90@mail.toshiba
Hi,
the CIP kernel team has released Linux kernel v4.19.325-cip137. The linux-4.19.y-cip tree's base version has been updated to v4.19-st21. The trees are up-to-date with kernel 5.10.271.
You can get this release via the git tree or as a tarball from https://mirrors.edge.kernel.org/pub/linux/kernel/projects/cip/4.19/
v4.19.325-cip137:
repository:
https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
branch:
linux-4.19.y-cip
commit hash:
1bb512106982a56a0eb71afb604bb3afa03d1d46
Fixed CVEs:
CVE-2024-56545: HID: hyperv: streamline driver probe to avoid devres issues
CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock()
CVE-2026-93279: staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
CVE-2026-97952: sunvdc: unmap LDC cookies when the descriptor send fails
CVE-2026-98600: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
CVE-2022-50406: iomap: iomap: fix memory corruption when recording errors during writeback
CVE-2023-53707: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops.
CVE-2024-58094: jfs: add check read-only before truncation in jfs_truncate_nolock()
CVE-2024-58095: jfs: add check read-only before txBeginAnon() call
CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send()
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility
CVE-2025-68190: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
CVE-2026-100070: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger
CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill
CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries
CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
CVE-2026-68155: libceph: Reject monmaps advertising zero monitors
CVE-2026-68236: drm/amd/display: set new_stream to NULL after release
CVE-2026-68476: ipvs: reload ip header after head reallocation
CVE-2026-72255: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket
CVE-2026-74460: can: ems_usb: validate CPC message lengths
CVE-2026-74496: fou: Fix use-after-free in fou_create()
CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths
CVE-2026-74626: NTB: ntb_netdev: Preserve RX queue depth on allocation failure
CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers
CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race
CVE-2026-74650: staging: rtl8723bs: fix OOB read in WMM_param_handler()
CVE-2026-74662: inet: frags: publish queues before arming timer
CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies
CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration
CVE-2026-74668: packet: use consistent hard_header_len in TX_RING send path
CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev
CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id
CVE-2026-80536: xfs: bounds-check buffer log item's dirty bitmap
CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check
CVE-2026-80562: gpio: ml-ioh: use raw_spinlock_t for the register lock
CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly
CVE-2026-80671: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown
CVE-2026-80765: HID: hyperv: validate initial device info bounds
CVE-2026-80767: HID: sensor: custom: Fix use-after-free in enable_sensor
CVE-2026-80781: HID: core: fix OOB read of field->usage in hid_set_field()
CVE-2026-80782: HID: magicmouse: do not keep a stale msc->input if no input is claimed
CVE-2026-80790: nvmet-fc: fix invalid free in LS IOD error path
CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment()
CVE-2026-80794: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
CVE-2026-80795: nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
CVE-2026-80796: nfc: nci: add data_len bound checks to activation parameter extractors
CVE-2026-80797: nfc: pn533: purge fragmented skbs during cleanup
CVE-2026-80798: nfc: llcp: reject PDUs shorter than the LLCP header
CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
CVE-2026-80800: nfc: llcp: bound the connect_sn TLV walk to the skb
CVE-2026-80801: nfc: microread: validate target discovery payload lengths
CVE-2026-80802: nfc: fdp: bound the device-reported read length and fix an skb leak
CVE-2026-80803: nfc: digital: clamp SENSF_RES length to the destination buffer
CVE-2026-80807: nilfs2: reject invalid block index in GC ioctl
CVE-2026-80808: ext4: stop retrying saturated xattr cache entries
CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs
CVE-2026-80814: rndis_host: add overflow check in rndis_rx_fixup()
CVE-2026-80819: Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
CVE-2026-80823: nfc: st21nfca: validate ATR_REQ length against the received frame
CVE-2026-80824: usb: usbfs: fix use-after-free of usb_device in usbdev_release()
CVE-2026-80826: USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
CVE-2026-80827: USB: serial: option: fix slab OOB read in interrupt URB callback
CVE-2026-80829: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
CVE-2026-80830: usb: core: Add lock to usb_wakeup_notification()
CVE-2026-80831: crypto: mxs-dcp - fix source scatterlist length access
CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation
CVE-2026-80843: xfrm: fix xfrm_state_construct() auth-trunc leak
CVE-2026-80844: xfrm: ah6: validate routing header segments_left
CVE-2026-80854: usb: gadget: f_tcm: keep port count until LUN teardown completes
CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources()
CVE-2026-80888: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
CVE-2026-80912: selinux: reject an unclaimed class value in security_get_classes()
CVE-2026-80918: HID: core: fix number/pointer type confusion on long items
CVE-2026-80930: tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
CVE-2026-80931: w1: ds28e17: reject an oversize length on an I2C block read
CVE-2026-80949: wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
CVE-2026-80963: dm-stats: fix a crash if allocation of per-cpu data fails
CVE-2026-80965: ALSA: serial-u16550: Check card index validity at probe
CVE-2026-80966: ALSA: portman2x4: Check card index validity at probe
CVE-2026-80968: ALSA: mts64: Check card index validity at probe
CVE-2026-80969: ALSA: mpu401: Check card index validity at probe
CVE-2026-80971: ALSA: bcd2000: clear the URB pointers on disconnect
CVE-2026-80973: ALSA: 6fire: bound the MIDI event length from the device
CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation
CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error()
CVE-2026-80978: net: cap advertised IP tunnel headroom
CVE-2026-80987: NTB: ntb_transport: Reject oversized TX buffers
CVE-2026-80988: NTB: ntb_transport: Fail TX enqueue when the QP link is down
CVE-2026-80994: net: openvswitch: fix flow mask use-after-free on flow deletion
CVE-2026-81000: net: tun: bound receive headroom
CVE-2026-81001: slip: fix use-after-free in sl_sync()
CVE-2026-81003: net/iucv: filter frames in afiucv_hs_rcv() by ingress device
CVE-2026-81005: ipmi: si: Fix NULL pointer dereference after failed registration
CVE-2026-89440: mmc: via-sdmmc: stop card-detect handling on probe failure
CVE-2026-89461: power: supply: max17040: synchronize work cancellation on suspend
CVE-2026-89469: power: supply: lp8727: fix use-after-free in lp8727_release_irq()
CVE-2026-89476: sctp: fix stream->outcnt underflow on duplicate RECONF responses
CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion
CVE-2026-89478: sctp: drop a chunk if its transport was removed
CVE-2026-89479: sctp: stop processing a packet once its association is deleted
CVE-2026-89483: nvme: zero the discard fallback page
CVE-2026-89487: openvswitch: only skb_tx_error() a packet we are about to drop
CVE-2026-89488: openvswitch: Fix CT limit teardown use-after-free
CVE-2026-89489: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
CVE-2026-89490: ocfs2: fix readdir position truncation on 32-bit kernels
CVE-2026-89493: ocfs2: validate rl_used against rl_count in refcount block validator
CVE-2026-89494: ocfs2: validate lengths in dlm_mig_lockres_handler
CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler
CVE-2026-89496: ocfs2: always run deallocs on copy-on-write completion
CVE-2026-89497: orangefs: skip leading spaces before parsing client debug masks
CVE-2026-89498: orangefs: fix double-free of trailer_buf on readdir copy failure
CVE-2026-89504: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing
CVE-2026-89515: scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
CVE-2026-89524: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
CVE-2026-89525: udf: reject VAT indexes equal to the entry count
CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry
CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks
CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail
CVE-2026-89549: sunrpc: route to a populated pool in svc_pool_for_cpu()
CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
CVE-2026-89555: mpls: reload header after pskb_may_pull()
CVE-2026-89559: libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
CVE-2026-89562: ip6_gre: fix hardware header length for NBMA tunnels
CVE-2026-89563: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling
CVE-2026-89573: dm array: reject an array block whose value size is not the caller's
CVE-2026-89575: dm raid1: reserve space for NUL-terminator in build_constructor_string()
CVE-2026-89576: dm-era: fix shadowed superblock leak on take-snap failure
CVE-2026-89582: bnx2x: fix double free in bnx2x_init_firmware() error path
CVE-2026-89586: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
CVE-2026-89594: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
CVE-2026-89595: fsnotify: Fix stale object mask after concurrent mark updates
CVE-2026-89596: forcedeth: fix off-by-one when saving/restoring non-PCI config space
CVE-2026-89597: fbdev: uvesafb: unregister connector callback on init failure
CVE-2026-89599: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
CVE-2026-89605: ecryptfs: release message context on send failure
CVE-2026-89606: ecryptfs: reject too-small tag 70 packets
CVE-2026-89607: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
CVE-2026-89608: ecryptfs: pass packet set buffer size to parser
CVE-2026-89609: ecryptfs: hold msg ctx list lock when cleaning daemon queue
CVE-2026-89626: HID: sensor: custom: Fix field sysfs group cleanup on failure
CVE-2026-89627: HID: roccat: free buffered reports when destroying device
CVE-2026-89628: HID: picolcd: clamp eeprom debugfs read to bytes actually received
CVE-2026-89643: audit: avoid dropping live tree ref on fsnotify rule autoremove
CVE-2026-89649: ceph: bound xattr value length in __build_xattrs()
CVE-2026-89655: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids
CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
CVE-2026-89711: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
CVE-2026-89723: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
CVE-2026-89725: media: cec: stm32: prevent out-of-bounds write on RX overflow
CVE-2026-89726: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
CVE-2026-89729: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
CVE-2026-89732: usb: gadget: f_fs: Prevent deadlock during ep0 read loop
CVE-2026-89736: usb: gadget: u_audio: Fix use-after-free on sound card disconnect
CVE-2026-89741: Revert "media: v4l2-dev: fix error handling in __video_register_device()"
CVE-2026-89742: rapidio: mport_cdev: fix use-after-free in dma_req_free()
CVE-2026-89749: tracing: Fix crash passing ERR_PTR to kthread_stop()
CVE-2026-89753: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
CVE-2026-89777: vfio/pci: clear vdev->msi_perm after freeing it on init failure
CVE-2026-89780: net: qualcomm: rmnet: restore skb->dev on deaggregated frames
CVE-2026-89783: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
CVE-2026-89816: drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
CVE-2026-89821: drm/amd/display: avoid divide-by-zero in __is_lut_linear()
CVE-2026-89843: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
CVE-2026-89845: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
CVE-2026-89846: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
CVE-2026-89852: scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
CVE-2026-89854: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
CVE-2026-89855: scsi: qla2xxx: Serialize flash version read in reset handler
CVE-2026-89856: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
CVE-2026-89858: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
CVE-2026-89861: scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
CVE-2026-89864: scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
CVE-2026-89865: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
CVE-2026-89872: media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
CVE-2026-89876: media: tda18250: fix possible integer overflow
CVE-2026-89878: media: s2255: check firmware size before reading trailing marker
CVE-2026-89879: media: s2255: bound JPEG frame size before copying into the buffer
CVE-2026-89887: media: i2c: ov7740: fix use-after-destroy in remove
CVE-2026-89890: media: go7007: defer the ALSA v4l2 put until card release
CVE-2026-89893: media: cx23885: cancel NetUP CI work before teardown
CVE-2026-89895: media: cobalt: Avoid freeing ALSA private data twice
CVE-2026-89897: media: cec: Serialize exclusive follower delivery
CVE-2026-89923: KVM: s390: Free guest debug data on vcpu destroy
CVE-2026-89924: KVM: s390: Fix old_data leak in guest debug error path
CVE-2026-89925: KVM: s390: Fix memory leak in guest debug handling
CVE-2026-89927: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
CVE-2026-89936: iio: dac: m62332: Fix regulator reference count imbalance
CVE-2026-89945: ASoC: cs35l34: drain threaded IRQ before runtime suspend
CVE-2026-89946: ASoC: cs35l33: drain threaded IRQ before runtime suspend
CVE-2026-89948: batman-adv: bla: fix freeing of claims on meshif deletion
CVE-2026-89949: batman-adv: dat: avoid unaligned fault in IP extraction
CVE-2026-89951: batman-adv: fix stale receive device on merged fragments
CVE-2026-89952: mtd: rawnand: validate ONFI extended parameter page sections
CVE-2026-89953: mtd: mtdoops: free page bitmap when the backing MTD is removed
CVE-2026-89964: parisc: eisa: Fix infinite loop when parsing invalid IRQ value
CVE-2026-89965: nvdimm/btt: reject an arena whose nfree is below the lane count
CVE-2026-89979: ALSA: pcm: Fix race between non-atomic ops and trigger-start
CVE-2026-89982: i2c: mux: Fix channel node leak on adapter add failure
CVE-2026-89997: dm: fix resume-vs-remove race
CVE-2026-89999: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
CVE-2026-90000: HID: rmi: fix OOB access with undersized RMI reports
CVE-2026-90007: scsi: pm8001: Use rollback index when freeing MSI-X vectors
CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload
CVE-2026-90015: xhci: fix lost bounce buffers on TDs spanning several ring segments
CVE-2026-90017: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
CVE-2026-90020: USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
CVE-2026-90031: usb-storage: ene_ub6250: fix race between scan work and probe
CVE-2026-90033: ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
CVE-2026-90034: usb: image: mdc800: change kmalloc() to kzalloc()
CVE-2026-90049: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-90054: tcp: fix corruption of urgent data on multi-segment retransmit
CVE-2026-90055: usb: atm: usbatm: fix invalid ci_range initialization
CVE-2026-90056: net: fec: only stop PTP if it was initialized
CVE-2026-90058: net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
CVE-2026-90068: ASoC: dapm: Fix off-by-one check on the second enum channel
CVE-2026-90070: tpm: st33zp24: Return zero on status read failure
CVE-2026-90071: net/sched: sch_teql: restore skb->dev on the slave failure path
CVE-2026-90072: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
CVE-2026-90073: net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
CVE-2026-90075: net/sched: fq_codel: clamp default quantum and mtu
CVE-2026-90081: net/rds: use wq_has_sleeper() in rds_cong_map_updated()
CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
CVE-2026-90102: NFSv4/pnfs: key the data server cache on the NFS version
CVE-2026-90103: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
CVE-2026-90114: net: bridge: Reject descending VLAN tunnel ranges
CVE-2026-90126: rtc: pcf8563: fix clock provider leak on unbind
CVE-2026-90141: ipvs: fix integer overflow in ftp helper port/address parsing
CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90160: lwt_bpf: Restore reserved headroom after xmit program
CVE-2026-90202: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
CVE-2026-90203: Squashfs: check block offset is not negative
CVE-2026-90216: ubi: Fix rollback for explicit UBI device numbers
CVE-2026-90222: nfc: pn533: hold a reference to the request skb during send_frame
CVE-2026-90223: nfc: llcp: bound SNL TLV parsing to the skb and add length checks
CVE-2026-90225: nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
CVE-2026-90226: nfc: llcp: avoid userspace overflow on invalid optlen
CVE-2026-90245: fbdev: kyro: Validate overlay viewport coordinates
CVE-2026-90283: hugetlbfs: release subpool on fill_super failure
CVE-2026-90284: firmware_loader: do not queue completed sysfs fallback requests
CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration
CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered
CVE-2026-90295: cpufreq: imx6q: fix out-of-bounds write when probed more than once
CVE-2026-90296: cpufreq: imx6q: fix devres accumulation across driver rebind
CVE-2026-90297: drm/sun4i: crtc: Propagate layer initialization error
CVE-2026-90302: ocfs2: synchronize heartbeat callbacks with o2net teardown
CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
CVE-2026-90314: remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
CVE-2026-90318: fat: release buffer head after rebuilding parent
CVE-2026-90319: rapidio: clear mport->net when rio_add_net() fails
CVE-2026-90327: phonet: pep: do not write beyond optlen in getsockopt
CVE-2026-90334: tty: clear cdev pointer after cdev_add() failure
CVE-2026-90360: regulator: core: use system_freezable_wq for init complete work
CVE-2026-90382: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
CVE-2026-90395: power: supply: isp1704_charger: cancel work on remove
CVE-2026-90403: wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
CVE-2026-90411: nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90414: IB/isert: reject PDUs declaring more data than was received
CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails
CVE-2026-90416: RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
CVE-2026-90419: nilfs2: prevent out-of-bounds read in super root block parsing
CVE-2026-90420: nilfs2: fix infinite loop in nilfs_clean_segments()
CVE-2026-90431: remoteproc: Prevent crash handling to race with rproc_del()
CVE-2026-90434: isofs: release zisofs block pointer buffer head
CVE-2026-92498: wifi: ath6kl: avoid buffer overreads in WMI event handlers
CVE-2026-92521: ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
CVE-2026-92522: ACPI: processor: validate MADT IOAPIC entry bounds
CVE-2026-92524: irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors
CVE-2026-93039: ASoC: meson: Keep link pointers valid on realloc failure
CVE-2026-93048: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
CVE-2026-93049: mtd: mtdswap: Avoid freeing registered blktrans device twice
CVE-2026-93053: speakup: keyhelp: guard letter_offsets possible out-of-range indexing
CVE-2026-93054: uio: Fix stale info pointer in failed registration path
CVE-2026-93055: UDF symlink pathComponent header OOB read
CVE-2026-93061: gpu: host1x: Avoid stack over-read in debug output helpers
CVE-2026-93098: rpmsg: glink: fix deadlock in endpoint destroy during driver detach
CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown
CVE-2026-93120: usb: gadget: configfs: fix out-of-bounds read of qw_sign
CVE-2026-93141: usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
CVE-2026-93177: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
CVE-2026-93178: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
CVE-2026-93188: HID: roccat: bound device-supplied profile index
CVE-2026-93189: HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
CVE-2026-93203: batman-adv: bla: avoid CRC corruption due to parallel claim add
CVE-2026-93204: batman-adv: dat: atomically update mac addresses
CVE-2026-93206: PCI/proc: Use file_ns_capable() when checking config space read access
CVE-2026-93213: of: fix out-of-bounds read in of_alias_scan() stem parser
CVE-2026-93214: usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
CVE-2026-93219: clocksource/drivers/timer-sun4i: Advertise a real minimum delta
CVE-2026-93245: apparmor: policy_int make sure list heads are initialized before fail path
CVE-2026-93252: ocfs2: fix circular locking dependency in ocfs2_init_acl()
CVE-2026-93256: arm64: hibernate: mask DAIF before restoring hibernated kernel
CVE-2026-93261: locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush()
CVE-2026-93268: ext4: skip extra isize expansion during mount to prevent deadlock
CVE-2026-93280: greybus: audio: bound the topology section sizes against the fetched size
CVE-2026-93286: net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
CVE-2026-93287: i2c: smbus: reject oversized block transfers in the common path
CVE-2026-93782: vhost-scsi: flush backend after device ioctls
CVE-2026-93783: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
CVE-2026-93785: cifs: validate idmap key payload length
CVE-2026-93789: wifi: iwlwifi: bound aligned TLV advance in FW parser
CVE-2026-93802: wifi: rsi: validate beacon length before fixed buffer copy
CVE-2026-93803: wifi: libipw: fix key index receive bound checks
CVE-2026-93807: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
CVE-2026-93808: ALSA: usb-audio: caiaq: validate EP1 reply lengths
CVE-2026-93815: net: au1000: move free_irq out of the close-time spinlocked section
CVE-2026-93816: f2fs: validate inline dentry name lengths before conversion
CVE-2026-93830: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
CVE-2026-97408: Bluetooth: L2CAP: validate connectionless PSM length
CVE-2026-97411: net: ibm: emac: mal: fix potential system hang in mal_remove()
CVE-2026-97416: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
CVE-2026-97417: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
CVE-2026-97418: ALSA: es18xx: check control allocation before private data setup
CVE-2026-97419: hsr: broadcast netlink notifications in the device's net namespace
CVE-2026-97430: xhci: Prevent queuing new commands if xhci is inaccessible
CVE-2026-97443: perf/ftrace: Fix WARNING in __unregister_ftrace_function
CVE-2026-97446: ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
CVE-2026-97448: ACPICA: Add validation for node in acpi_ns_build_normalized_path()
CVE-2026-97450: ACPICA: validate handler object type in two places
CVE-2026-97451: ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
CVE-2026-97452: ACPICA: Prevent adding invalid references
CVE-2026-97453: ACPICA: validate byte_count in acpi_ps_get_next_package_length()
CVE-2026-97456: ACPICA: Fix condition check in acpi_ps_parse_loop()
CVE-2026-97472: ipv6: addrconf: fix temp address generation after prefix deprecation
CVE-2026-97481: serial: 8250: fix possible ISR soft lockup
CVE-2026-97482: usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
CVE-2026-97483: usb: core: hcd: fix possible deadlock in rh control transfers
CVE-2026-97484: usbip: vhci_hcd: fix NULL deref in status_show_vhci
CVE-2026-97486: hpfs: handle set_blocksize failures
CVE-2026-97487: jfs: handle set_blocksize failures
CVE-2026-97488: qnx4: handle set_blocksize failures
CVE-2026-97489: bfs: handle set_blocksize failures
CVE-2026-97490: affs: handle set_blocksize failures
CVE-2026-97492: wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
CVE-2026-97502: mmc: davinci: avoid NULL deref of host->data in IRQ handler
CVE-2026-97507: media: dm1105: fix missing error check for dma_alloc_coherent
CVE-2026-97508: thunderbolt: Set tb->root_switch to NULL when domain is stopped
CVE-2026-97510: thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
CVE-2026-97596: ipvs: reject invalid states in connection template sync records
CVE-2026-97598: ipv4: fib: bound automatic table ID allocation
CVE-2026-97601: ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
CVE-2026-97612: net: mpls: clear inner_protocol when the last label is popped
CVE-2026-97904: cpufreq: initialize policy rwsem before sysfs publication
CVE-2026-97905: cpufreq: zero-initialize policy cpumask before sysfs publication
CVE-2026-97909: ASoC: sti: initialize IRQ lock before requesting IRQ
CVE-2026-97923: tracing: Free histogram the var ref when its initialization fails
CVE-2026-97931: ALSA: us122l: Prevent write upgrades for read mappings
CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop
CVE-2026-97954: net/rds: fix tcp stream corruption with large pages
CVE-2026-97958: net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
CVE-2026-97959: net/sched: cls_route: free emptied bucket on filter move
CVE-2026-97981: net: ethernet: cortina: Count dropped frames as NAPI work
CVE-2026-97982: net: ethernet: cortina: Fix budget accounting
CVE-2026-97995: virtio_console: do not free control-out buffers on remove
CVE-2026-97998: netfilter: nfnetlink_log: cope with concurrent instance destruction
CVE-2026-98006: ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
CVE-2026-98011: net/sched: hhf: clamp quantum in change and init paths
CVE-2026-98012: net/sched: sfq: clamp quantum in change path
CVE-2026-98022: net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
CVE-2026-98025: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
CVE-2026-98066: ALSA: caiaq: Fix potential double-free at error path
CVE-2026-98068: net/rds: don't let rds_conn_shutdown() consume a concurrent drop
CVE-2026-98069: net/rds: acquire the fastpath locks in rds_conn_shutdown()
CVE-2026-98070: net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
CVE-2026-98071: net/rds: clear cp_flags bits individually in rds_conn_path_reset()
CVE-2026-98072: net/rds: use wq_has_sleeper() in release_in_xmit()
CVE-2026-98074: bonding: do not clear curr_active_slave prematurely when releasing all slaves
CVE-2026-98077: netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
CVE-2026-98078: ipvs: fix reversed sequence option serialization
CVE-2026-98080: btrfs: do not force reloc root creation during qgroup_account_snapshot()
CVE-2026-98094: staging: fbtft: make dirty_lock IRQ-safe
CVE-2026-98095: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
CVE-2026-98096: ipv6: sr: restore network header before routing and forwarding
CVE-2026-98123: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
CVE-2026-98157: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
CVE-2026-98158: ppp_async: drop the errored frame instead of resetting its headroom
CVE-2026-98160: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
CVE-2026-98185: wifi: mwifiex: validate scan response extents
CVE-2026-98186: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
CVE-2026-98187: wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
CVE-2026-98188: wifi: p54: validate curve data length in the calibration curve converters
CVE-2026-98191: wifi: wlcore: release runtime PM ref on regdomain config failure
CVE-2026-98194: wifi: libertas_tf: fix UAF in lbtf_free_adapter()
CVE-2026-98195: wifi: iwlegacy: fix broadcast stations deallocation
CVE-2026-98196: wifi: brcmsmac: fix UAF in brcms_free_timer()
CVE-2026-98197: hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
CVE-2026-98201: Input: zero ff_effect before compat copy in input_ff_effect_from_user
CVE-2026-98202: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
CVE-2026-98203: Input: soc_button_array - check btns_desc->package.count
CVE-2026-98204: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
CVE-2026-98205: Input: evdev - zero absinfo before partial copy in EVIOCSABS
CVE-2026-98207: mmc: spi: reset bytes_xfered before retrying CRC failures
CVE-2026-98208: mmc: sdio_uart: fix xmit_fifo leak when the port table is full
CVE-2026-98210: mmc: mxcmmc: cancel data work and watchdog on remove
CVE-2026-98217: IB/mlx4: Fix use-after-free on pkey sysfs registration failure
CVE-2026-98233: net/packet: clear RX owner on VNET header error
CVE-2026-98234: net/sched: hhf: cap hh_flows_limit at change time
CVE-2026-98241: ipv6: xfrm: use full sockets in local error paths
CVE-2026-98251: openvswitch: avoid reallocating confirmed conntrack labels
CVE-2026-98252: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
CVE-2026-98255: tcp: exclude old ACKs from tcp fast path
CVE-2026-98262: ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
CVE-2026-98275: net: ethernet: cortina: Ack RX overrun interrupt correctly
CVE-2026-98276: net: lock the socket in sock_gettstamp()
CVE-2026-98282: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
CVE-2026-98298: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
CVE-2026-98299: tcp: do not let tcp_rmem be set below 4096
CVE-2026-98300: tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
CVE-2026-98302: net: fddi: skfp: fix NULL deref when setting the MAC address while down
CVE-2026-98306: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
CVE-2026-98308: ALSA: hda: trace PCM open only after assigning a stream
CVE-2026-98314: ALSA: pcm: set timer->private_data before registering the PCM timer
CVE-2026-98319: drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
CVE-2026-98320: netfilter: flowtable: hold reference on ct until flow is released
CVE-2026-98340: wifi: cfg80211: only group hidden BSSes with beacon entries
CVE-2026-98345: wifi: cfg80211: check IP header size in cfg80211_classify8021d()
CVE-2026-98347: IB/IPoIB: Avoid restoring OPER_UP after multicast flush
CVE-2026-98348: wifi: libipw: reject too-short association responses
CVE-2026-98349: wifi: libipw: reject too-short beacon and probe responses
CVE-2026-98354: RDMA/mad: Fix receive buffer leak when PKey enforcement fails
CVE-2026-98362: clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
CVE-2026-98363: firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
CVE-2026-98379: netfilter: ip6t_rpfilter: reject routes without inet6_dev
CVE-2026-98380: net/sched: reject IDR error pointers when deleting actions
CVE-2026-98383: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
CVE-2026-98404: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
CVE-2026-98407: wifi: rsi: fix heap OOB write on key removal
CVE-2026-98419: drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
CVE-2026-98422: wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
CVE-2026-98426: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period
CVE-2026-98455: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
CVE-2026-98457: Bluetooth: L2CAP: validate frame length before control and FCS access
CVE-2026-98460: Bluetooth: hci_sock: reject out-of-range OCF values
CVE-2026-98461: Bluetooth: hci_sock: validate event length before filtering
CVE-2026-98476: s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
CVE-2026-98481: nfc: port100: reject frames whose declared length exceeds the received data
CVE-2026-98482: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
CVE-2026-98485: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
CVE-2026-98488: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
CVE-2026-98489: net: atl1c: fix soft lockup on out-of-range tpd_cons read
CVE-2026-98491: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
CVE-2026-98494: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
CVE-2026-98499: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
CVE-2026-98501: HID: alps: fix use-after-free on input2 registration failure
CVE-2026-98514: drm/nouveau: Fix gem reference leak in validate_init()
CVE-2026-98515: drm/nouveau: fix double-free in nvif_vmm_dtor
CVE-2026-98516: drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
CVE-2026-98524: rds: ib: Clear the sg list when mapping an MR fails
CVE-2026-98526: llc: reserve device headroom for allocated frames
CVE-2026-98527: gpio: zynq: fix runtime PM leak on request error path
CVE-2026-98529: gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
CVE-2026-98531: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
CVE-2026-98532: ipv6: do not let ipv6_find_hdr() return an offset past the packet end
CVE-2026-98535: fsl/fman: Fix clk reference leak in read_dts_node()
CVE-2026-98537: workqueue: Fix NULL current_pwq deref in flush dependency check
CVE-2026-98541: fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
CVE-2026-98547: af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
CVE-2026-98548: sctp: discard the rest of the packet on a stale-cookie error
CVE-2026-98550: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
CVE-2026-98554: vlan: ensure sufficient headroom in vlan_dev_hard_header()
CVE-2026-98555: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
CVE-2026-98567: net: xps: reject an out of range traffic class
CVE-2026-98569: ip_gre: Reject enabling collect metadata through changelink
CVE-2026-98573: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
CVE-2026-98575: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
CVE-2026-98576: nfc: llcp: fix slab-out-of-bounds reads when logging service names
CVE-2026-98577: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
CVE-2026-98578: nfc: st21nfca: validate ISO15693 inventory length
CVE-2026-98581: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
CVE-2026-98582: nfc: st21nfca: validate received frame size
CVE-2026-98583: nfc: nfcmrvl: validate helper command length before pull
CVE-2026-98594: tg3: clean up PHYLIB resources on probe failure
CVE-2026-98597: net: usb: sr9700: include receive overhead in the length check
CVE-2026-98608: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
CVE-2026-98609: drm/virtio: fix object leak when drm_gem_handle_create() fails
CVE-2026-98610: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
CVE-2026-98612: net: usb: catc: bound the RX packet length in catc_rx_done()
CVE-2026-98614: sctp: avoid livelock while updating retransmit path
CVE-2026-98621: net: gue: reject invalid REMCSUM offsets
CVE-2026-98623: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
CVE-2026-98624: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
CVE-2026-98636: squashfs: Add dictionary size range check to prevent shift-out-of-bounds
CVE-2026-98643: bpf: Fix out-of-bounds read of rtt_min in sock_ops
CVE-2026-98872: freevxfs: don't BUG() on unknown typed-extent type
CVE-2026-98873: netfilter: nf_conntrack_expect: zero at allocation time
CVE-2026-98877: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
CVE-2026-98879: isofs: handle set_blocksize failures
CVE-2026-98885: ima: return error early if file xattr cannot be changed
CVE-2026-98886: drm/gma500: return errors from Oaktrail HDMI I2C reads
CVE-2026-98890: wifi: libertas: reject short monitor TX frames
CVE-2026-98891: wifi: mac80211: validate deauth frame length before reason access
CVE-2026-98898: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
CVE-2026-98900: xen/gntalloc: validate grant count before allocation
CVE-2026-98902: md/raid5: let stripe batch bm_seq comparison wrap-safe
CVE-2026-98912: ALSA: seq: oss: Reject reads that cannot fit the next event
CVE-2026-99999: ipv4: validate checksum_start before completing checksum
Best regards,
Ulrich Hecht
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-11-13 16:34 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-13 16:33 [ANNOUNCE] Release v4.19.325-cip137 Ulrich Hecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox